01 Record

CVE-2017-5754

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel

MediumPUBLISHEDCNA: intel

CNA base score5.6 CVSS v3.xCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

View raw JSON

02 Description

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

84.17% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 99.7% of scored records. A rank, not a probability.

NVD base score

5.6 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2018-01-04 13:00Z8 YR AGO

Last updated

2026-05-28 17:53Z3 MO AGO

Reserved

2017-02-01

Assigning CNA

intel

Record state

PUBLISHED

Severity

Medium (CVSS 5.6)

CNA CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses

CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass
CWE-208Observable Timing DiscrepancyBase

Data version

5.2

Document digest

cc031307a1e4a3cb2c8f17ceb72d700bab2780e7657ad86608a4c655cf481279

05 Affected products

VendorProductVersionsPlatforms

Intel CorporationMost Modern Operating SystemsAll—

06 References

nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4609x_refsource_CONFIRM
usn.ubuntu.comUSN-3523-1https://usn.ubuntu.com/3523-1/vendor-advisoryx_refsource_UBUNTU
usn.ubuntu.comUSN-3525-1https://usn.ubuntu.com/usn/usn-3525-1/vendor-advisoryx_refsource_UBUNTU
www.codeaurora.orghttps://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinx_refsource_CONFIRM
security.gentoo.orgGLSA-201810-06https://security.gentoo.org/glsa/201810-06vendor-advisoryx_refsource_GENTOO
www.debian.orgDSA-4082https://www.debian.org/security/2018/dsa-4082vendor-advisoryx_refsource_DEBIAN
support.citrix.comhttps://support.citrix.com/article/CTX234679x_refsource_CONFIRM
usn.ubuntu.comUSN-3540-2https://usn.ubuntu.com/3540-2/vendor-advisoryx_refsource_UBUNTU
usn.ubuntu.comUSN-3522-3https://usn.ubuntu.com/3522-3/vendor-advisoryx_refsource_UBUNTU
access.redhat.comhttps://access.redhat.com/security/vulnerabilities/speculativeexecutionx_refsource_CONFIRM
lists.debian.org[debian-lts-announce] 20180107 [SECURITY] [DLA 1232-1] linux security updatehttps://lists.debian.org/debian-lts-announce/2018/01/msg00004.htmlmailing-listx_refsource_MLIST
portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002x_refsource_CONFIRM
usn.ubuntu.comUSN-3597-1https://usn.ubuntu.com/3597-1/vendor-advisoryx_refsource_UBUNTU
lists.opensuse.orgSUSE-SU-2018:0012http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgSUSE-SU-2018:0011http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlvendor-advisoryx_refsource_SUSE
nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4611x_refsource_CONFIRM
security.googleblog.comhttps://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.htmlx_refsource_MISC
cert.vde.comhttps://cert.vde.com/en-us/advisories/vde-2018-002x_refsource_CONFIRM
www.debian.orgDSA-4120https://www.debian.org/security/2018/dsa-4120vendor-advisoryx_refsource_DEBIAN
support.f5.comhttps://support.f5.com/csp/article/K91229003x_refsource_CONFIRM
usn.ubuntu.comUSN-3524-2https://usn.ubuntu.com/usn/usn-3524-2/vendor-advisoryx_refsource_UBUNTU
www.debian.orgDSA-4078https://www.debian.org/security/2018/dsa-4078vendor-advisoryx_refsource_DEBIAN
source.android.comhttps://source.android.com/security/bulletin/2018-04-01x_refsource_CONFIRM
lists.opensuse.orgopenSUSE-SU-2018:0022http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.htmlvendor-advisoryx_refsource_SUSE
access.redhat.comRHSA-2018:0292https://access.redhat.com/errata/RHSA-2018:0292vendor-advisoryx_refsource_REDHAT
xenbits.xen.orghttp://xenbits.xen.org/xsa/advisory-254.htmlx_refsource_CONFIRM
security.netapp.comhttps://security.netapp.com/advisory/ntap-20180104-0001/x_refsource_CONFIRM
www.synology.comhttps://www.synology.com/support/security/Synology_SA_18_01x_refsource_CONFIRM
www.arubanetworks.comhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txtx_refsource_CONFIRM
help.ecostruxureit.comhttps://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0x_refsource_CONFIRM
developer.arm.comhttps://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityx_refsource_CONFIRM
www.kb.cert.orgVU#584653http://www.kb.cert.org/vuls/id/584653third-party-advisoryx_refsource_CERT-VN
usn.ubuntu.comUSN-3522-2https://usn.ubuntu.com/usn/usn-3522-2/vendor-advisoryx_refsource_UBUNTU
www.kb.cert.orgVU#180049https://www.kb.cert.org/vuls/id/180049third-party-advisoryx_refsource_CERT-VN
usn.ubuntu.comUSN-3583-1https://usn.ubuntu.com/3583-1/vendor-advisoryx_refsource_UBUNTU
cert.vde.comhttps://cert.vde.com/en-us/advisories/vde-2018-003x_refsource_CONFIRM
help.ecostruxureit.comhttps://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixesx_refsource_CONFIRM
support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_usx_refsource_CONFIRM
www.mitel.comhttps://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001x_refsource_CONFIRM
support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_usx_refsource_CONFIRM
www.suse.comhttps://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/x_refsource_CONFIRM
support.citrix.comhttps://support.citrix.com/article/CTX231399x_refsource_CONFIRM
www.securityfocus.com102378http://www.securityfocus.com/bid/102378vdb-entryx_refsource_BID
security.freebsd.orgFreeBSD-SA-18:03https://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.ascvendor-advisoryx_refsource_FREEBSD
aws.amazon.comhttps://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/x_refsource_CONFIRM
www.securityfocus.com106128http://www.securityfocus.com/bid/106128vdb-entryx_refsource_BID
blog.mozilla.orghttps://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/x_refsource_CONFIRM
www.securitytracker.com1040071http://www.securitytracker.com/id/1040071vdb-entryx_refsource_SECTRACK
usn.ubuntu.comUSN-3597-2https://usn.ubuntu.com/3597-2/vendor-advisoryx_refsource_UBUNTU
nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4614x_refsource_CONFIRM
lists.opensuse.orgSUSE-SU-2018:0010http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.htmlvendor-advisoryx_refsource_SUSE
tools.cisco.com20180104 CPU Side-Channel Information Disclosure Vulnerabilitieshttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannelvendor-advisoryx_refsource_CISCO
usn.ubuntu.comUSN-3523-2https://usn.ubuntu.com/usn/usn-3523-2/vendor-advisoryx_refsource_UBUNTU
usn.ubuntu.comUSN-3516-1https://usn.ubuntu.com/usn/usn-3516-1/vendor-advisoryx_refsource_UBUNTU
usn.ubuntu.comUSN-3541-2https://usn.ubuntu.com/3541-2/vendor-advisoryx_refsource_UBUNTU
googleprojectzero.blogspot.comhttps://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlx_refsource_MISC
support.lenovo.comhttps://support.lenovo.com/us/en/solutions/LEN-18282x_refsource_CONFIRM
meltdownattack.comhttps://meltdownattack.com/x_refsource_MISC
lists.opensuse.orgopenSUSE-SU-2018:0023http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.htmlvendor-advisoryx_refsource_SUSE
nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4613x_refsource_CONFIRM
usn.ubuntu.comUSN-3522-4https://usn.ubuntu.com/3522-4/vendor-advisoryx_refsource_UBUNTU
www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlx_refsource_MISC
www.arubanetworks.comhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txtx_refsource_CONFIRM
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfx_refsource_CONFIRM
www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
cdrdv2.intel.comhttps://cdrdv2.intel.com/v1/dl/getContent/685358x_refsource_CONFIRM

01 Record index

CVE-2017-5754

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2017-5754

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References